diff --git a/backend/open_webui/config.py b/backend/open_webui/config.py index ae174a65a..c79406597 100644 --- a/backend/open_webui/config.py +++ b/backend/open_webui/config.py @@ -591,7 +591,11 @@ OAUTH_ALLOWED_ROLES = PersistentConfig( OAUTH_ADMIN_ROLES = PersistentConfig( "OAUTH_ADMIN_ROLES", "oauth.admin_roles", - [role.strip() for role in os.environ.get("OAUTH_ADMIN_ROLES", "admin").split(SEP) if role], + [ + role.strip() + for role in os.environ.get("OAUTH_ADMIN_ROLES", "admin").split(SEP) + if role + ], ) OAUTH_ALLOWED_DOMAINS = PersistentConfig( diff --git a/backend/open_webui/main.py b/backend/open_webui/main.py index 76cb9d7e0..1405a4306 100644 --- a/backend/open_webui/main.py +++ b/backend/open_webui/main.py @@ -1556,13 +1556,15 @@ async def chat_completion( log.info("Chat processing was cancelled") try: event_emitter = get_event_emitter(metadata) - await asyncio.shield(event_emitter( - {"type": "chat:tasks:cancel"}, - )) + await asyncio.shield( + event_emitter( + {"type": "chat:tasks:cancel"}, + ) + ) except Exception as e: pass finally: - raise # re-raise to ensure proper task cancellation handling + raise # re-raise to ensure proper task cancellation handling except Exception as e: log.debug(f"Error processing chat payload: {e}") if metadata.get("chat_id") and metadata.get("message_id"): diff --git a/backend/open_webui/retrieval/loaders/youtube.py b/backend/open_webui/retrieval/loaders/youtube.py index adf51d922..cba602ed8 100644 --- a/backend/open_webui/retrieval/loaders/youtube.py +++ b/backend/open_webui/retrieval/loaders/youtube.py @@ -83,7 +83,7 @@ class YoutubeLoader: TranscriptsDisabled, YouTubeTranscriptApi, ) - from youtube_transcript_api.proxies import (GenericProxyConfig) + from youtube_transcript_api.proxies import GenericProxyConfig except ImportError: raise ImportError( 'Could not import "youtube_transcript_api" Python package. ' @@ -91,7 +91,9 @@ class YoutubeLoader: ) if self.proxy_url: - youtube_proxies = GenericProxyConfig(http_url=self.proxy_url, https_url=self.proxy_url) + youtube_proxies = GenericProxyConfig( + http_url=self.proxy_url, https_url=self.proxy_url + ) log.debug(f"Using proxy URL: {self.proxy_url[:14]}...") else: youtube_proxies = None diff --git a/backend/open_webui/utils/mcp/client.py b/backend/open_webui/utils/mcp/client.py index 67903b94d..6edfca4f6 100644 --- a/backend/open_webui/utils/mcp/client.py +++ b/backend/open_webui/utils/mcp/client.py @@ -9,6 +9,7 @@ from mcp.client.auth import OAuthClientProvider, TokenStorage from mcp.client.streamable_http import streamablehttp_client from mcp.shared.auth import OAuthClientInformationFull, OAuthClientMetadata, OAuthToken + class MCPClient: def __init__(self): self.session: Optional[ClientSession] = None @@ -35,7 +36,6 @@ class MCPClient: except Exception as e: await asyncio.shield(self.disconnect()) raise e - async def list_tool_specs(self) -> Optional[dict]: if not self.session: diff --git a/docs/SECURITY.md b/docs/SECURITY.md index fd4f5e839..a9463269d 100644 --- a/docs/SECURITY.md +++ b/docs/SECURITY.md @@ -44,7 +44,7 @@ We appreciate the community's interest in identifying potential vulnerabilities. > - Screenshots/videos demonstrating the exploit (supplementary to written steps) > > **Failure to provide a reproducible PoC may lead to closure of the report** -> +> > We will notify you, if we struggle to reproduce the exploit using your PoC to allow you to improve your PoC. > However, if we repeatedly cannot reproduce the exploit using the PoC, the report may be closed. @@ -65,8 +65,7 @@ We appreciate the community's interest in identifying potential vulnerabilities. 9. **CVSS Scoring Accuracy:** If you include a CVSS score with your report, it must accurately reflect the vulnerability according to CVSS methodology. Common errors include 1) rating PR:N (None) when authentication is required, 2) scoring hypothetical attack chains instead of the actual vulnerability, or 3) inflating severity without evidence. **We will adjust inaccurate CVSS scores.** Intentionally inflated scores may result in report rejection. -> [!WARNING] -> **Using CVE Precedents:** If you cite other CVEs to support your report, ensure they are **genuinely comparable** in vulnerability type, threat model, and attack vector. Citing CVEs from different product categories, different vulnerability classes or different deployment models will lead us to suspect the use of AI in your report. +> [!WARNING] > **Using CVE Precedents:** If you cite other CVEs to support your report, ensure they are **genuinely comparable** in vulnerability type, threat model, and attack vector. Citing CVEs from different product categories, different vulnerability classes or different deployment models will lead us to suspect the use of AI in your report. 11. **Admin Actions Are Out of Scope:** Vulnerabilities that require an administrator to actively perform unsafe actions are **not considered valid vulnerabilities**. Admins have full system control and are expected to understand the security implications of their actions and configurations. This includes but is not limited to: adding malicious external servers (models, tools, webhooks), pasting untrusted code into Functions/Tools, or intentionally weakening security settings. **Reports requiring admin negligence or social engineering of admins may be rejected.** diff --git a/src/app.css b/src/app.css index cf5d0360c..6a85c69d7 100644 --- a/src/app.css +++ b/src/app.css @@ -152,10 +152,10 @@ select { -webkit-appearance: none; } -.dark select:not([class*="bg-transparent"]) { +.dark select:not([class*='bg-transparent']) { @apply bg-gray-900 text-gray-300; } - + .dark select option { @apply bg-gray-850 text-white; } diff --git a/src/app.html b/src/app.html index 432d59795..9333dc8ba 100644 --- a/src/app.html +++ b/src/app.html @@ -23,11 +23,7 @@ href="/static/apple-touch-icon.png" crossorigin="use-credentials" /> - + {#if showWebSearchButton || showImageGenerationButton || showCodeInterpreterButton || showToolsButton || (toggleFilters && toggleFilters.length > 0)} -
+